Affiliate fraud turns website visits into someone else's commissions.

Affiliate fraud on a website sends traffic through tracked offers without an honest referral. Attackers inject a loader, frame or redirect into the site, then let a traffic controller choose what each browser does.

compromised page or deceptive landing
  -> injected loader profiles the visit
  -> hidden request, forced click or redirect
  -> affiliate tracker records the visit
  -> browser reaches an offer or another redirect

Redirects that wait for the right visitor

Some injections load a small remote script and leave the routing decision to its server. Others check screen width and browser details first, so a desktop site owner sees the expected page while a mobile visitor is sent elsewhere. We match maintenance pages that redirect mobile browsers, loaders that request per-visitor configuration and landers that turn the Back button into another offer.

The click can be disguised as an ordinary control. One matched article popup opens an off-screen advertising link when the visitor closes the popup or clicks its backdrop. Other pages present prizes, game currency, registration portals or account notices before handing the visitor to a tracked destination.

Hidden frames and cookie stuffing

An off-screen frame can open a tracked affiliate route without taking over the visible page. The destination can then set an attribution cookie, giving the affiliate credit if that browser later buys something. We have matched injected scripts that create large frames outside the viewport and feed them into redirect trackers carrying referral campaign values.

Look beyond the final address. A chain can replay the current path and query on a mirror, send a token through several controllers or keep a once-per-day marker in browser storage. Those gates make repeat checks look clean.

TrackMyPoss and Lnkr

TrackMyPoss sends the site and referrer to a controller, stores returned state in the browser and runs JavaScript from the reply. The reply we retained redirected the visitor to a push and Back-button advertising page.

Lnkr posts visitor context to a routing server and follows its returned destination. Its newer redirector requests high-entropy browser details and checks automation before replacing the current page.

What we see across infected sites

Month	New sites
September	877
October so far	336

40% of the affiliate-fraud sites captured since 25 September run WordPress. 6% made requests for Joomla core paths. Of the 72 sites recaptured at least 25 days after their first match, 55 still served affiliate-fraud code (76%).

Checking a site

Test the logged-out site on mobile and desktop, with the browser network log open. Check for:

• unfamiliar script tags added to the page head or footer
• frames positioned off-screen or reduced to an invisible size
• redirects that run only on mobile, after a delay or after a click
• close buttons, backdrops and Back-button handlers that open another address
• browser-storage keys that suppress the redirect for a day or longer
• requests carrying referral, campaign, click or visitor identifiers

Remove the injected loader and every cached copy. Compare themes, plugins and site templates with trusted releases, review administrator and hosting access, rotate those credentials and test the page again from a clean browser profile.